Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2024-6200

HaloITSM - Stored Cross-Site Scripting in Tickets

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC.ch

Description

HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Halo Service Solutions HaloITSM

Default version status: unaffected

  • < 2.146.1affected

References